← Back to SOC feed Coverage →

URLhaus: elf Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-03T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving newly discovered ELF (Executable and Linkable Format) malware distributed through malicious URLs, which often serve as initial infection vectors for Windows-based systems. Proactively hunting for these specific URL patterns in Azure Sentinel is critical to intercept early-stage threats before they execute payloads that could compromise endpoint integrity or facilitate lateral movement within the network.

IOC Summary

Threat: elf Total URLs: 30 Active URLs: 21

URLStatusThreatDate Added
hxxp://94.154.43.238/bins/m68konlinemalware_download2026-08-03
hxxp://94.154.43.238/bins/mpslonlinemalware_download2026-08-03
hxxp://94.154.43.238/bins/mipsonlinemalware_download2026-08-03
hxxp://94.154.43.238/bins/sh4onlinemalware_download2026-08-03
hxxp://94.154.43.238/bins/i686onlinemalware_download2026-08-03
hxxp://94.154.43.238/bins/spconlinemalware_download2026-08-03
hxxp://94.154.43.238/bins/x86_64onlinemalware_download2026-08-03
hxxp://94.154.43.238/bins/ppconlinemalware_download2026-08-03
hxxp://94.154.43.238/bins/x86onlinemalware_download2026-08-03
hxxp://94.154.43.238/bins/dbgonlinemalware_download2026-08-03
hxxp://193.233.82.82/bins/x86_64onlinemalware_download2026-08-03
hxxp://193.233.82.82/bins/spconlinemalware_download2026-08-03
hxxp://193.233.82.82/bins/dbgonlinemalware_download2026-08-03
hxxp://193.233.82.82/bins/i686onlinemalware_download2026-08-03
hxxp://193.233.82.82/bins/m68konlinemalware_download2026-08-03
hxxp://193.233.82.82/bins/sh4onlinemalware_download2026-08-03
hxxp://193.233.82.82/bins/x86onlinemalware_download2026-08-03
hxxp://193.233.82.82/bins/mpslonlinemalware_download2026-08-03
hxxp://193.233.82.82/bins/ppconlinemalware_download2026-08-03
hxxp://193.233.82.82/bins/mipsonlinemalware_download2026-08-03
hxxp://204.10.194.60/xlumen/lkxstress.spcofflinemalware_download2026-08-03
hxxp://204.10.194.60/xlumen/lkxstress.mpslofflinemalware_download2026-08-03
hxxp://204.10.194.60/xlumen/lkxstress.x86offlinemalware_download2026-08-03
hxxp://204.10.194.60/xlumen/lkxstress.i686offlinemalware_download2026-08-03
hxxp://204.10.194.60/xlumen/lkxstress.sh4offlinemalware_download2026-08-03

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["94.154.43.238", "193.233.82.82", "31.77.227.111"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.238", "193.233.82.82", "31.77.227.111"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, along with targeted exclusion strategies:

Original source: https://urlhaus.abuse.ch/